Abstraction and subsumption in modular verification of C programs

Abstract

The type-theoretic notions of existential abstraction, subtyping, subsumption, and intersection have useful analogues in separation-logic proofs of imperative programs. We have implemented these as an enhancement of the verified software toolchain (VST). VST is an impredicative concurrent separation logic for the C language, implemented in the Coq proof assistant, and proved sound in Coq. For machine-checked functional-correctness verification of software at scale, VST embeds its expressive program logic in dependently typed higher-order logic (CiC). Specifications and proofs in the program logic can leverage the expressiveness of CiC—so users can overcome the abstraction gaps that stand in the way of top-to-bottom verification: gaps between source code verification, compilation, and domain-specific reasoning, and between different analysis techniques or formalisms. Until now, VST has supported the specification of a program as a flat collection of function specifications (in higher-order separation logic)—one proves that each function correctly implements its specification, assuming the specifications of the functions it calls. But what if a function has more than one specification? In this work, we exploit type-theoretic concepts to structure specification interfaces for C code. This brings modularity principles of modern software engineering to concrete program verification. Previous work used representation predicates to enable data abstraction in separation logic. We go further, introducing function-specification subsumption and intersection specifications to organize the multiple specifications that a function is typically associated with. As in type theory, if $\phi$ is a of $\psi$, that is $\phi <:\psi$, then $x:\phi$ implies $x:\psi$, meaning that any function satisfying specification $\phi$ can be used wherever a function satisfying $\psi$ is demanded. Subsumption incorporates separation-logic framing and parameter adaptation, as well as step-indexing and specifications constructed via mixed-variance functors (needed for C’s function pointers).

Appendix: Fully general funspec_sub

NDfunspec_sub as introduced in Sect. 5 specializes the “real” subtype relation $\phi <:\psi$ in two regards: first, it only applies if $\phi$ and $\psi$ are of the form, i.e. the types of their WITH-lists (“witnesses”) are trivial bifunctors as they do not contain co- or contravariant occurrences of . Second, it fails to exploit step-indexing and is hence unnecessarily strong. Our full definition is as follows (Definition in ):

We first note that is not a (Coq) osition but an —indeed, step-indexing has nothing interesting to say about pure propositions! That is, $P\vdash Q$ means, “for all resource-maps s, $P\,s$ implies $Q\,s$,” but this can be too strong: means, “for all resource-maps s whose step-index is $\le$ the current ‘age’, $P\,s$ implies $Q\,s$.” Recursive equations of s, of the kind that come up in object-oriented patterns, can tolerate where they cannot tolerate $\vdash$ [5, Chapter 17].

Second, both funspecs are constructors (mk_funspec $tsig \, cc \, A \, P \, Q\_~\_$) as discussed in Sect. 5, but the two final arguments (the proofs that P and Q are super-nonexpansive) are irrelevant for the remainder of the definition and hence anonymous. We also abbreviate the TypeTree-interpreting operator alluded to in Sect. 3, , with ${\mathcal {F}}$.

Third, the definition makes use of the following operators (details on the penultimate two operators can be found in [5], Chapter 16):

In particular, the satisfaction of $P_2$ implies, only with the “precision” (in the step-indexed sense) at which $P_2$ is satisfied, that $Q_1$ implies $Q_2$.

Finally, note that the definition internally existentially quantifies over yet another , the frame F.

It is straightforward to prove that is reflexive, transitive, and specializes to . To obtain soundness of context subtyping ( ), we Kripke-extend the previous definition of VST’s main semantic judgment . We also refined the definition of the predicate : a stronger version of rule permits the exposed specification f to be a (step-indexed) abstraction of the specification g stored in VST’s resource-instrumented model:

As refers to the memory, this notion is again an . Again, users who don’t have complex object-oriented recursion patterns can avoid the step-indexing by using this non-step-indexed variant,

as the following lemma shows:

As one might expect, both notions are compatible with further subsumption:

With these modifications and auxiliary lemmas in place, we have formally reestablished the soundness proof of VST’s proof rules, justifying all rules given in this paper.